CVE-2020-22249

CVE-2020-22249 is a critical Remote Code Execution (RCE) vulnerability affecting phplist version 3.5.1. The flaw allows an attacker to upload malicious plugin files with various PHP extensions (e.g., .php, .phtml) due to insufficient file extension validation, leading to arbitrary code execution on the server. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with no user interaction or privileges required, enabling full compromise of confidentiality, integrity, and availability. While no public exploits (Metasploit, Nuclei, ExploitDB) or active exploitation have been identified, and community discussion is minimal, the high FAUCET Risk Score of 82/100 indicates significant potential danger.